Splunk Enterprise Security

Phantom: When running a Splunk action why the error "Failed to acquire lock"?

New Member

Hi All,

We are running an Splunk action - run query (search) on a Phantom playbook which is active on every event coming on to phantom. However, at times the action - run query (search) fails with message: Failed to acquire lock named '08' for Action: 'run query', App: 'Splunk'. Failed to acquire the lock '08'. The action - run query (search) tries to execute for 30 minutes or so and eventually fails. Any help to troubleshoot this issue is highly appreciated.


Thanks in advance 🙂


Labels (2)
0 Karma

New Member

I had this issue today, and I had to go back through my phantom events, and there was a run query that had been running for 24 hours. I'm not sure why it didn't time out, but find when your error started happening and look at the phantom event right before it and see if there is an action that is stuck in a running state and terminate it.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...